Generally, cryptographic systems are used to prevent unauthorized disclosure of information during transmission and/or storage of data. The process of encryption involves the manipulation of data so that it is unreadable, in effect making the content inaccessible, to an unauthorized entity. The process of decryption involves the manipulation of encrypted data so as to recreate the original scheduled condition of the data, or to transform the encrypted data into readable data that corresponds to the original unencrypted data. Secrecy is not the only advantage provided by encryption. The process of encryption ensures data integrity, as encrypted data that has been modified does not decrypt properly unless the proper, that is, authorized, procedures are followed. It is the integrity property provided by encryption that is used by the present invention, as well as its security properties.
The corporate world used to depend solely on paper to operate. Hard copy documents were used to provide corporate governance, settle disputes at law, and formed the basis for audits by tax and regulatory authorities, internal authorized recipients, and independent accountants. In many instances, this is no longer the case. As business moves to electronic operational and accounting systems, hard copy documents in many cases either do not exist or are merely incidental to electronic records. This lack of hard copy affects the ability of management and other interested parties to manage and audit corporate systems.
An original paper document carries a degree of presumption of authenticity that cannot currently be attributed to an electronic file. Changes can be virtually impossible to detect in the electronic world. With electronic data interchange, a company uses computers, computer programs, and transmission links to automatically transact business with customers and suppliers. With image processing systems, documents are scanned and converted to digital images. The original documents may not be retained. Some electronic information may exist for only a short time and may not be retrievable if files are updated and backup files do not exist.
A company may have many information and control systems. In this context, a system is the entire combination, or a logical sub-part, of tangible and intangible elements that, acting together, protect assets and provide reliable data, or the assurance thereof. The tangible part of the system includes, but is not limited to, paper documents and the markings and signatures made thereon, as well as the physical processes and procedures used to safeguard assets. System intangibles include policies and procedures providing instructions and structure to the business process.
Management and other interested parties must determine that policies, procedures, and instructions are carried out to a sufficient degree in a timely fashion. Information and control systems provide this assurance. Authorized recipients review information and control systems to determine if the design of each meets stated objectives. They also review the synergistic effect of all relevant systems to determine their overall effectiveness. If the sum of all system designs are deemed to be effective in producing stated objectives, authorized recipients then must perform tests of these systems in order to prove the systems actually exist and are functioning as represented by management.
Based on the volume of information involved, authorized recipients and others reviewing corporate activities cannot directly examine all activities and data produced by a company. They must devise tests for evaluating the activities and data that they can directly examine, in order to provide a reliable indication of the overall well-being of the corporation. The nature, timing, and extent of these tests are based on professional judgment. Tests include those steps necessary to verify that stated control elements exist and are functioning as intended. Tests also include the examination of particular transactions to provide operational assurance on a statistical basis.
The tests of both controls and transactions may include the examination of documents produced both within the company and by outside entities. For some audit objectives, such as confirmation of balances, activities, agreements, etc., evidence will be obtained from parties independent of the company. The authorized recipient""s goal is to reduce to an acceptable level the risk of not discovering a material misstatement or system control deficiency. If an authorized recipient cannot reduce detection risk to an acceptable level, it may be impossible to render an unqualified opinion.
As more businesses adopt electronic systems and interact electronically with vendors and customers, the ability to reliably audit both controls and transactions is greatly diminished, perhaps, in some cases, to the point that serious adverse control and audit consequences will become common.
An objective of the present invention is to use encryption and encrypted objects to record and authenticate inputs, processes, scheduled conditions, and virtual environments of electronic accounting and operational systems, and to provide a means to distribute these encrypted objects to designated locations for access by designated individuals or entities.
Inputs in this context can be any individual action or sum of actions having any effect on a control or accounting system. Outputs in this context can be the result of any process or action of a control or accounting system. These actions may be transactional in nature, directly entered by a human being as the first electronically recorded action, or may be a result of computations within the system, or may be passed to the system by another system.